Integration: Kaseya SIEM and Graphus

Kaseya SIEM

NAVIGATION  At the partner level: Settings > Integrations > + New Integration > choose organization > Next > Graphus

NAVIGATION  At the organization level: Organizations > Edit Organization (pencil icon) > + New Application > Graphus

PERMISSIONS  Permission to manage integrations or organization applications in Kaseya SIEM

Graphus

NAVIGATION  MSP Administration > MSP Information

Before connecting Kaseya SIEM to Graphus, you must retrieve your MSP GUID from within Graphus.

1. Log in to Graphus.

2. Click MSP Administration.

   

3. From the side navigation menu, click MSP Information.

   

4. Copy your MSP GUID for use when connecting the integration in Kaseya SIEM.

   

1. In Kaseya SIEM, navigate to Settings > Integrations.

   

2. Click + New Integration.

   

3. Select the organization that will receive the Graphus data, and then click Next.

   

   • To create a new organization and use it for the integration, click Create New Organization and use.

     

   • Each organization can have one connection per application type.

4. Under Email Security, locate Graphus and click Connect.

   

5. Enter your Graphus MSP GUID.

   

6. Click Next.

7. Complete the Organization Mapping step (see below).

   

8. Click Finish to save the mapping.

   When configured at the partner level, Graphus appears in Settings > Integrations and displays the associated organization.

   

1. In Kaseya SIEM, from the side navigation menu, go to Organizations.

   

2. Click Edit Organization (pencil icon) for the organization you want to connect Graphus to.

   

3. Click + New Application.

   

4. Under Email Security, locate Graphus and click Connect.

   

5. Enter your Graphus MSP GUID.

   

6. Click Next.

7. Complete the Organization Mapping step (see below).

   

8. Click Finish to save the mapping.

When configured at the organization level, the Graphus application appears under the organization's Applications tab.

Two distinct types of data are processed by Kaseya SIEM for Graphus:

• Users and the actions they perform

• Devices and their respective alarms/alerts

User Activity Organization

Users and their actions are logged against the organization set as the User Activity Organization. This field is locked to the organization the integration is linked to and cannot be changed; this is the organization the product itself is connected to, and it will be used for all user activity inside the application.

Device Organization Mapping

Devices and their associated alerts/alarms are processed only if the Graphus organization is linked to a Kaseya SIEM organization in the Device Organization Mapping table. When a Graphus organization is mapped to a Kaseya SIEM organization, devices in that organization are imported and alerts/alarms for that organization are processed. Graphus organizations left unmapped will not have their devices discovered.

To complete mapping:

1. Review the Unmapped tab, which lists Kaseya SIEM organizations alongside a Graphus Organization drop-down menu and any Suggested Match.

   

2. For each row, either accept the suggested match or manually select the corresponding Graphus organization from the drop-down menu.

3. Optionally, enable Automatically map Organizations with 100% match. Turning this on automatically maps existing and new organizations when the name in the RMM matches the Graphus organization exactly, including letter case, punctuation, and spaces. This removes the need to manually map organizations for Unify device suggestions to begin populating.

   

   • When this toggle is On, an Ignore from Automatic Mapping drop-down menu appears. Use this to select specific Kaseya SIEM organizations that should be excluded from automatic mapping, even if their names match a Graphus organization exactly. This is useful when an exact name match exists but the organizations should not be linked.

     

4. Use the Mapped tab to review organizations that have already been linked.

5. Once mapping is complete, click Finish to save.

NOTE  Only mapped organizations will have their devices discovered and alerts processed. If a Kaseya SIEM organization doesn't appear as expected, or a Graphus organization is missing from the drop-down menu, verify that the organization exists correctly on the Graphus side and that data has synced.

To disable the integration:

1. Navigate to the Graphus integration.

   • If configured at the partner level, go to Settings > Integrations, locate Graphus, and select View details.

     

   • If configured at the organization level, go to Organizations, click Edit Organization (pencil icon), and the Applications tab will be displayed. Click the Graphus tile.

2. Select Disconnect Application.

   

3. Confirm the action.

Results

• Graphus data is no longer ingested into Kaseya SIEM.

• Existing Graphus email security monitoring remains unchanged.

• The integration can be reconnected later.

Only your Graphus MSP GUID, found in Graphus under MSP Administration > MSP Information. No separate URL is required in Kaseya SIEM.

Devices in that organization will not be discovered by Kaseya SIEM, and alerts/alarms for that organization will not be processed. User activity is still logged against the selected User Activity Organization regardless of device mapping.

No. It is locked to the organization the integration is linked to and cannot be changed from the wizard.

When enabled, it automatically maps existing and new organizations whenever the name in the RMM matches the Graphus organization exactly (including letter case, punctuation, and spaces), removing the need for manual mapping.

No. Disabling the integration stops data ingestion into Kaseya SIEM but does not change monitoring or configuration in Graphus.